CVE-2022-48339: Command Injection
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Other sources
GNU Emacs could allow a local attacker to execute arbitrary commands on the system, caused by a flaw in the hfy-istext-command function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-48339?
CVE-2022-48339 is a vulnerability discovered in GNU Emacs through version 28.2, involving a command injection vulnerability in htmlfontify.el.
What is the severity of CVE-2022-48339?
The severity of CVE-2022-48339 is high, with a severity value of 7.8.
How does CVE-2022-48339 affect GNU Emacs?
CVE-2022-48339 affects GNU Emacs versions up to 28.2 and can be exploited through the htmlfontify.el package.
How can I fix CVE-2022-48339 in GNU Emacs?
To fix CVE-2022-48339 in GNU Emacs, it is recommended to update to a patched version of GNU Emacs, such as version 28.3 or later when available.
Where can I find more information about CVE-2022-48339?
You can find more information about CVE-2022-48339 on the GNU Emacs commit page and the Debian and Fedora security advisories linked in the references section.